The need for robust access control that scales has never been greater. Rich visibility into who and what are on your network along with the ability to segment end-to-end using a software-defined approach are critical requirements of customers who are seeing an explosion of connected devices as well as a perpetual deluge of network breaches across every industry. Which is why the latest version of Cisco ISE doubles-down on outcomes that realize a secure digital network. It does this through enabling automation, administrative simplification, and net new capabilities.
ISE 2.3 offers DNA Center integration, new policy UI, enhanced posture, guest network login using Facebook credentials, read-only access, many ACS parity features, an Upgrade Readiness Tool and more! For additional details, see the ISE 2.3 Release Notes.
Enabling the Cisco Software-Defined Access architecture
Now you can manage and automate your network - including policy and access - from a single dashboard with Cisco DNA Center. DNA Center is a holistic, end-to-end network management platform for the Network. Intuitive. Integrating ISE allows the DNA Center to define and enact policy to control access across the network, all from a unified interface. Cisco ISE 2.3 is a required integration component for the DNA Center, along with APIC-EM and the Network Data Platform, which all make up the Software-Defined Access solution
Simpler policy creation and management
It is now easier to create and manage policies with the new policy interface. These simplified policy sets are more readable and include all of the authentication and authorization rules, and allow you to easily create and reuse conditions. After upgrading your policies will work as before, though additional policy sets have been created. See the video below for more information. The new policy UI now includes a hit counter for each policy set.
ISE with AnyConnect now provides additional endpoint visibility, including BIOS-level details such as the computer’s serial number, USB attachments, and resource utilization, including disk and memory usage. ISE is now able to perform posture assessment on Windows and Mac OS endpoints without a persistent agent. This new approach replaces the existing web agent and makes use of a temporal agent, which has similar posture checks as the full AnyConnect secure mobility client but without required endpoint administrative privileges or reliance on browser plugins. Cisco continues to offer a wide range of posture agents to assist with different deployments. This includes the option for a stealth agent to display flexible notifications via OS messaging frameworks.
Social login for guest services
Guests will have the choice to log into the network using their Facebook credentials. This can be an option in addition to creating a local ISE account. Social login for guests provides seamless a guest experience that's an easy and fast way to allow guest access to the network.
Read-only admin support
Read-only access allows network administrators to grant others access to review existing configurations, generate reports, and plan accordingly, without the right to make changes.
Final phase of ACS parity
ISE 2.3 includes the final suite of capabilities designed to reach feature parity with Cisco Secure Access Control System (ACS), allowing all existing ACS customers to migrate their deployment to ISE. New features include TACACS+-based device administration for IPv6, import and export capabilities for TACACS+-based command sets, policy export scheduling, IP range support in all octets, and more. See the ACS vs ISE Comparison for feature comparisons with every release of ISE.
Upgrade Readiness Tool (URT)
The Upgrade Readiness Tool (URT) should be run prior to an ISE software upgrade in order to detect and fix any data upgrade issues. Most of the upgrade failures occur because of data upgrade issues and the URT is designed to validate the data before the actual upgrade. The URT will report and try to fix the issues, wherever possible. The URT is a separate download in the Cisco Software Center.
Hi Guys, I am new in WSA. I would like to ask for your advise on WSA healcheck. Usually what info do we capture for the healthcheck? Are all capture from GUI or some from Cli? If from Cli, is there any command? And also c...
In ISE Portals and Components you have the ability to modify the various Guest Type settings. One option is to add custom fields to collect additional data from the guest when they access a guest portal. What can be done with these additional fields? Can ...
Hello: I have the above mentioned router and am attempting to configure it to bring up an L2TP/IPSec connection with a windows client.It completes phase 1 fine but fails the phase 2 negotiation stating the transforms don't match but it seems that the...
Hi everyoneFirst of all i hope you all are safe from this pandemic.I saw following link about "Emergency COVID-19 AnyConnect License". would you please anyone confirm this procedure is working for multiple context ASA-SM also? and what part numbers s...
Hi, I tried to find dot1x authentication details or fail reason. Reason was because I can see lots of fail radius logs of MAB but I trying to check the reason why dot1x fail-was it because it wasn't a dot1x device or it was a 3rd party device (w...